T09 · Insecure Skill Coding Practices
- Location
scripts/fetch_growth_rank.py:131- Finding
Unescaped Remote API Fields Permit Markdown Content and Link Injection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fetch_growth_rank.py:131-134, 193-199
Vulnerability Type: Markdown content and link injection
Risk Level: MediumTechnical Analysis
The script obtains article metadata from the remote RedFox API and interpolates it directly into a Markdown table without escaping Markdown control characters, removing line breaks, or validating the URL scheme.
The vulnerable link construction is:
python def make_link(title: str, url: str) -> str: """生成Markdown链接""" t, u = safe_str(title), safe_str(url) return f'[{t}]({u})' if t != "-" and u != "-" else tThe resulting value, together with the remotely supplied account name and other fields, is inserted directly into the output table:
python for rank_num, (acc, score) in enumerate(scored_data, 1): max_w = acc.get("maxWork") or {} user = safe_str(acc.get("userName")) lines.append( f"| {rank_num} | {user} | {make_link(max_w.get('title'), max_w.get('oriUrl'))} | " f"{format_count(max_w.get('watchCount'))} | {format_count(max_w.get('likeCount'))} | " f"{format_count(max_w.get('shareCount'))} | {safe_str(max_w.get('clicksCount'))} | " f"{safe_str(max_w.get('publicTime'))} | {score:.2f} |" )Fields such as
userName,maxWork.title,maxWork.oriUrl, andmaxWork.publicTimeoriginate in the external API response. Markdown metacharacters such as|,[,],(,), and embedded newlines are not neutralized. A crafted title can terminate the intended Markdown link or table cell and introduce additional links or rows. The URL is also accepted without restricting it to a safe scheme.The exposure is reinforced by
SKILL.md:123andreferences/core_workflow.md:22-25, which require the assistant to reproduce the script's standard output verbatim. Consequently, the agent is instructed not to sanitize malformed or deceptive remote content ...[truncated 1541 chars]- Remediation
View remediation
Remediation Suggestions
- Escape Markdown metacharacters in every remotely supplied text field before inserting it into the table, including backslashes, pipes, brackets, parentheses, carriage returns, and newlines.
- Normalize multiline values to a single line so remote data cannot create additional rows or break table structure.
- Parse
oriUrlwith a standard URL parser and permit only expected schemes, preferablyhttps. - If the service has a defined set of legitimate article hosts, enforce an explicit hostname allowlist or visibly mark links to other hosts.
- Reject control characters and malformed URLs rather than rendering them.
- Keep raw API data separate from presentation data. The requirement to reproduce stdout verbatim should apply only after the script has safely encoded all external fields.
- Add regression tests using titles, account names, dates, and URLs containing pipes, newlines, brackets, nested links, and non-HTTPS schemes.